You are here
Home > Preporuke > Nadogradnja za java-1_8_0-openjdk

Nadogradnja za java-1_8_0-openjdk

  • Detalji os-a: LSU
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LSU

openSUSE Security Update: Security update for java-1_8_0-openjdk
______________________________________________________________________________

Announcement ID: openSUSE-SU-2015:1289-1
Rating: important
References: #937828 #938248
Cross-References: CVE-2015-2590 CVE-2015-2597 CVE-2015-2601
CVE-2015-2613 CVE-2015-2619 CVE-2015-2621
CVE-2015-2625 CVE-2015-2627 CVE-2015-2628
CVE-2015-2632 CVE-2015-2637 CVE-2015-2638
CVE-2015-2659 CVE-2015-2664 CVE-2015-2808
CVE-2015-4000 CVE-2015-4729 CVE-2015-4731
CVE-2015-4732 CVE-2015-4733 CVE-2015-4736
CVE-2015-4748 CVE-2015-4749 CVE-2015-4760

Affected Products:
openSUSE 13.2
______________________________________________________________________________

An update that fixes 24 vulnerabilities is now available.

Description:

OpenJDK was updated to 2.6.1 – OpenJDK 8u51 to fix security issues and
bugs.

The following vulnerabilities were fixed:

* CVE-2015-2590: Easily exploitable vulnerability in the Libraries
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-2597: Easily exploitable vulnerability in the Install component
requiring logon to Operating System. Successful attack of this
vulnerability could have resulted in unauthorized Operating System
takeover including arbitrary code execution.
* CVE-2015-2601: Easily exploitable vulnerability in the JCE component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2613: Easily exploitable vulnerability in the JCE component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java SE, Java SE Embedded
accessible data.
* CVE-2015-2619: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2621: Easily exploitable vulnerability in the JMX component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized read access to a subset of Java accessible data.
* CVE-2015-2627: Very difficult to exploit vulnerability in the Install
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2628: Easily exploitable vulnerability in the CORBA component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-2632: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2637: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2638: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-2659: Easily exploitable vulnerability in the Security
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized ability to cause a partial denial of service
(partial DOS).
* CVE-2015-2664: Difficult to exploit vulnerability in the Deployment
component requiring logon to Operating System. Successful attack of this
vulnerability could have resulted in unauthorized Operating System
takeover including arbitrary code execution.
* CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some Java accessible
data as well as read access to a subset of Java accessible data.
* CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some Java accessible
data as well as read access to a subset of Java Embedded accessible data.
* CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized update, insert or delete access to some Java SE
accessible data as well as read access to a subset of Java SE accessible
data.
* CVE-2015-4731: Easily exploitable vulnerability in the JMX component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4732: Easily exploitable vulnerability in the Libraries
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-4733: Easily exploitable vulnerability in the RMI component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4736: Difficult to exploit vulnerability in the Deployment
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-4748: Very difficult to exploit vulnerability in the Security
component allowed successful unauthenticated network attacks via OCSP.
Successful attack of this vulnerability could have resulted in
unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized ability to cause a partial denial of service (partial
DOS).
* CVE-2015-4760: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.2:

zypper in -t patch openSUSE-2015-512=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.2 (i586 x86_64):

java-1_8_0-openjdk-1.8.0.51-12.1
java-1_8_0-openjdk-accessibility-1.8.0.51-12.1
java-1_8_0-openjdk-debuginfo-1.8.0.51-12.1
java-1_8_0-openjdk-debugsource-1.8.0.51-12.1
java-1_8_0-openjdk-demo-1.8.0.51-12.1
java-1_8_0-openjdk-demo-debuginfo-1.8.0.51-12.1
java-1_8_0-openjdk-devel-1.8.0.51-12.1
java-1_8_0-openjdk-headless-1.8.0.51-12.1
java-1_8_0-openjdk-headless-debuginfo-1.8.0.51-12.1
java-1_8_0-openjdk-src-1.8.0.51-12.1

– openSUSE 13.2 (noarch):

java-1_8_0-openjdk-javadoc-1.8.0.51-12.1

References:

https://www.suse.com/security/cve/CVE-2015-2590.html
https://www.suse.com/security/cve/CVE-2015-2597.html
https://www.suse.com/security/cve/CVE-2015-2601.html
https://www.suse.com/security/cve/CVE-2015-2613.html
https://www.suse.com/security/cve/CVE-2015-2619.html
https://www.suse.com/security/cve/CVE-2015-2621.html
https://www.suse.com/security/cve/CVE-2015-2625.html
https://www.suse.com/security/cve/CVE-2015-2627.html
https://www.suse.com/security/cve/CVE-2015-2628.html
https://www.suse.com/security/cve/CVE-2015-2632.html
https://www.suse.com/security/cve/CVE-2015-2637.html
https://www.suse.com/security/cve/CVE-2015-2638.html
https://www.suse.com/security/cve/CVE-2015-2659.html
https://www.suse.com/security/cve/CVE-2015-2664.html
https://www.suse.com/security/cve/CVE-2015-2808.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://www.suse.com/security/cve/CVE-2015-4729.html
https://www.suse.com/security/cve/CVE-2015-4731.html
https://www.suse.com/security/cve/CVE-2015-4732.html
https://www.suse.com/security/cve/CVE-2015-4733.html
https://www.suse.com/security/cve/CVE-2015-4736.html
https://www.suse.com/security/cve/CVE-2015-4748.html
https://www.suse.com/security/cve/CVE-2015-4749.html
https://www.suse.com/security/cve/CVE-2015-4760.html
https://bugzilla.suse.com/937828
https://bugzilla.suse.com/938248


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
7e

AutorTomislav Protega
Cert idNCERT-REF-2015-07-0003-ADV
CveCVE-2010-2883 CVE-2010-2884 CVE-2010-2887 CVE-2010-2888
ID izvornikaopenSUSE-SU-2015:1289-1
ProizvodSecurity update for java-1_8_0-openjdk
Izvorhttp://www.suse.com
Top
More in Preporuke
Nadogradnja za java-1_7_0-openjdk

Izdana je nadogradnja koja otklanja ranjivosti u radu programskog paketa java-1_7_0-openjdk za openSUSE. Većina ranjivosti uzrokovana je nedefiniranim greškama u...

Close